CVE-2026-89947: clk: meson: align gxbb_32k_clk_sel number of parents with actual count
In the Linux kernel, the following vulnerability has been resolved:
clk: meson: align gxbb32kclksel number of parents with actual count
The following out-of-bounds read has been observed by Christian on a GXBB WeTek Hub: ================================================================== BUG: KASAN: global-out-of-bounds in clkregister+0x1b70/0x2418 Read of size 8 at addr ffffd66320cf88e0 by task swapper/0/1
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-rc5 #1 PREEMPT Hardware name: WeTek Hub (DT) Call trace: showstack+0x14/0x20 (C) dumpstacklvl+0x74/0x94 printreport+0x164/0x4b0 kasanreport+0x98/0xd8 asanreportload8noabort+0x1c/0x24 clkregister+0x1b70/0x2418 devmclkhwregister+0x74/0x15c mesonclkcinit+0xd4/0x20c mesonclkcsysconprobe+0x5c/0x94 platformprobe+0xbc/0x17c reallyprobe+0x184/0x844 driverprobedevice+0x154/0x35c driverprobedevice+0x60/0x188 driverattach+0x168/0x4a0 busforeachdev+0xec/0x180 driverattach+0x38/0x58 busadddriver+0x238/0x4c0 driverregister+0x150/0x388 platformdriverregister+0x54/0x7c gxbbclkcdriverinit+0x18/0x20 dooneinitcall+0xb8/0x340 kernelinitfreeable+0x49c/0x52c kernelinit+0x24/0x148 retfromfork+0x10/0x20
The buggy address belongs to the variable: gxbb32kclkparents+0x60/0x400
The buggy address belongs to a vmalloc virtual mapping The buggy address belongs to the physical page:
Memory state around the buggy address: ffffd66320cf8780: 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 ffffd66320cf8800: 00 04 f9 f9 f9 f9 f9 f9 00 04 f9 f9 f9 f9 f9 f9 ffffd66320cf8880: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 ^ ffffd66320cf8900: 00 01 f9 f9 f9 f9 f9 f9 00 06 f9 f9 f9 f9 f9 f9 ffffd66320cf8980: 00 00 02 f9 f9 f9 f9 f9 00 00 02 f9 f9 f9 f9 f9 ==================================================================
Commit 7915d7d5407c ("clk: amlogic: gxbb: drop non existing 32k clock parent") dropped a non-existing clock parent from the gxbb32kclksel mux but didn't adjust the hard-coded numparents field. Fix the actual number of parents of that mux by using ARRAYSIZE instead (avoiding similar problems in future).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 7.0.0-rc5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 7915d7d5407c
Event History
Frequently Asked Questions
Which systems are known to be exposed?
The out-of-bounds read was observed on a GXBB-based WeTek Hub using device tree support, during initialization of the Meson clock controller. The provided data does not establish impact on other hardware.
When does the issue occur?
It occurs while the Meson clock controller driver is registered and probed during kernel initialization. In the reported case, the fault was triggered by the swapper task during boot.
How can I determine whether this is affecting a system?
A KASAN-enabled kernel may report a global-out-of-bounds read in __clk_register, with a call trace including devm_clk_hw_register, meson_clkc_init, meson_clkc_syscon_probe, and gxbb_clkc_driver_init. The report describes an 8-byte read.